-
Notifications
You must be signed in to change notification settings - Fork 786
/
common_kube_rbac.go
102 lines (90 loc) · 3.13 KB
/
common_kube_rbac.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
package cmd
import (
"fmt"
"github.com/jenkins-x/jx/pkg/log"
"github.com/jenkins-x/jx/pkg/util"
corev1 "k8s.io/api/core/v1"
rbacv1 "k8s.io/api/rbac/v1"
meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)
func (o *CommonOptions) ensureServiceAccount(ns string, serviceAccountName string) error {
client, err := o.KubeClient()
if err != nil {
return err
}
_, err = client.CoreV1().ServiceAccounts(ns).Get(serviceAccountName, meta_v1.GetOptions{})
if err != nil {
// lets create a ServiceAccount for tiller
sa := &corev1.ServiceAccount{
ObjectMeta: meta_v1.ObjectMeta{
Name: serviceAccountName,
Namespace: ns,
},
}
_, err = client.CoreV1().ServiceAccounts(ns).Create(sa)
if err != nil {
return fmt.Errorf("Failed to create ServiceAccount %s in namespace %s: %s", serviceAccountName, ns, err)
}
log.Infof("Created ServiceAccount %s in namespace %s\n", util.ColorInfo(serviceAccountName), util.ColorInfo(ns))
}
return err
}
// Todo: use permissions from somewhere, or provide common ones in a class that we can pass in here
// this is an unimplemented and unused method for building upon that may eventually be of use
func (o *CommonOptions) ensureClusterRoleExists(roleName string, namespace string) error {
log.Infof("Ensuring cluster role exists, role name: %s, namespace: %s\n", roleName, namespace)
client, err := o.KubeClient()
if err != nil {
return err
}
_, err = client.RbacV1().ClusterRoles().Get(roleName, meta_v1.GetOptions{})
if err != nil {
log.Infof("Trying to create ClusterRole %s in namespace %s\n", roleName, namespace)
clusterRole := &rbacv1.ClusterRole{
ObjectMeta: meta_v1.ObjectMeta{
Name: roleName,
Namespace: namespace,
},
}
_, err = client.RbacV1().ClusterRoles().Create(clusterRole)
if err != nil {
return fmt.Errorf("Failed to create ClusterRole %s: %s", roleName, err)
}
log.Infof("Created ClusterRole %s in namespace %s\n", roleName, namespace)
}
return nil
}
func (o *CommonOptions) ensureClusterRoleBinding(clusterRoleBindingName string, role string, serviceAccountNamespace string, serviceAccountName string) error {
client, err := o.KubeClient()
if err != nil {
return err
}
_, err = client.RbacV1().ClusterRoleBindings().Get(clusterRoleBindingName, meta_v1.GetOptions{})
if err != nil {
log.Infof("Trying to create ClusterRoleBinding %s for role: %s and ServiceAccount: %s/%s\n",
clusterRoleBindingName, role, serviceAccountNamespace, serviceAccountName)
clusterRoleBinding := &rbacv1.ClusterRoleBinding{
ObjectMeta: meta_v1.ObjectMeta{
Name: clusterRoleBindingName,
},
Subjects: []rbacv1.Subject{
{
Kind: "ServiceAccount",
Name: serviceAccountName,
Namespace: serviceAccountNamespace,
},
},
RoleRef: rbacv1.RoleRef{
Kind: "ClusterRole",
Name: role,
APIGroup: "rbac.authorization.k8s.io",
},
}
_, err = client.RbacV1().ClusterRoleBindings().Create(clusterRoleBinding)
if err != nil {
return fmt.Errorf("Failed to create ClusterRoleBindings %s: %s", clusterRoleBindingName, err)
}
log.Infof("Created ClusterRoleBinding %s\n", clusterRoleBindingName)
}
return nil
}